Serve unit-test providers from a filesystem mirror

• Serve unit-test providers from a filesystem mirror

The unit tests copy tests/iac into a fresh $BATS_TEST_TMPDIR for each of the 27 test cases and run with --jobs 8, across 10 OpenTofu versions and two base images. Every tofu init therefore starts from an empty .terraform, and the job defines no cache, so a single pipeline resolves the providers from registry.opentofu.org several hundred times. That burst times out regularly; it accounts for the recurring failed to request discovery document failures.

The committed lock file does not help here. It removes the version lookup, but a cold init still asks the registry for download URLs and fetches the packages. Measured on 1.12.1, neither a lock file alone nor a lock file plus a warm TF_PLUGIN_CACHE_DIR avoids the network; a filesystem mirror with direct excluded does, with zero outbound requests.

A single provider-mirror job now builds the mirror with tofu providers mirror and publishes it as an artifact, leaving one upstream fetch per pipeline instead of several hundred. That job carries a retry, since it is the only remaining upstream dependency.

• Fix policy-enforcement cache never being applied

b98ac215 moved the job's inline cache: block into the lockfile_for_cache_key:{true,false} hidden jobs, but unlike the nine other templates it never added the corresponding entry to extends:. The hidden jobs have been dead configuration since, so the job has run without any cache at all:

• $GITLAB_TOFU_ROOT_DIR/.terraform/ is not cached, so providers are re-downloaded on every run.
• ./.gitlab-tofu/bin/tmp is not cached, so the OPA binary is re-downloaded from GitHub on every run. The "found in cache, reusing it" branch in before_script can never be taken.
• The documented use_lockfile_for_cache_key input has no effect.

Changelog: fixed